Research On Intrusion Detection Based On Improved Apriori Algorithm

The emergence of intrusion detection system solves a number of current network securities. But with computer networks developing fast and network traffic flow increasing rapidly, current intrusion detection system has some defects, such as difficult to handle vast amount of network data, low adaptive ability and high false alarm rate.The combination of date mining and intrusion detection improves the ability of intrusion detection system to handle data packet flow and gains flow signal to form rules. Moreover, it can make quick reflections to the detected abnormal and help managers to deal with attacks. Recently, the research of interdisciplinary draws much attention.Firstly, the paper introduces the date mining, and mainly analyzes the classification and process of association rules as a branch of it. Afterwards, on the basis of the classical association rules algorithm Apriori and its optimized algorithm, the advantages and disadvantages of Apriori Algorithm are thoroughly researched and deficiencies of the kind of algorithm are pointed out, such as the need for scanning databases many times, generating a large number of Candidate Anthology, as well as useless items in the frequent items.The paper presents a method to solve those problems. That is non-iterative Apriori advanced algorithm. It gets the maximal frequent items by intersecting transactions, while the degree of support of candidate item sets is determined by the times of intersections without scanning database. The method is fit for intrusion detection.At last, through examples and two groups of experiment separately analyzing and examining the advanced algorithm from theory and practice, its performance and efficiency has been improved.